THIS NOTICE DESCRIBES HOW BEHAVIORAL HEALTH/MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
Privacy is a very important concern for all those who come to this office. It is also complicated, because of the many federal and state laws and my professional ethics. Because the rules are so complicated, some parts of this notice are very detailed, and you probably will have to read them several times to understand them. If you have any questions, I will be happy to help you understand my procedures and your rights.
Contents of this notice
A. Introduction: To my clients
B. What I mean by your medical information
C. Privacy and the laws about privacy
D. How your protected health information can be used and shared
- 1. Uses and disclosures with your consent
- a. The basic uses and disclosures: For treatment, payment, and health care operations
- b. Other uses and disclosures in health care
- 2. Uses and disclosures that require your authorization
- 3. Uses and disclosures that don’t require your consent or authorization
- a. When required by law
- b. For law enforcement purposes
- c. For public health activities
- d. Relating to decedents
- e. For specific government functions
- f. To prevent a serious threat to health or safety
- 4. Uses and disclosures where you have an opportunity to object
- 5. An accounting of disclosures I have made
E. Your rights concerning your health information
F. In the event of a breach
G. If you have questions or problems
A. Introduction: To my clients
This notice will tell you how I handle your medical information. It tells how I use this information here in this office, how I share it with other professionals and organizations, and how you can see it. If you have any questions or want to know more about anything in this notice, please ask for more explanations or more details.
B. What I mean by your medical information
Each time you visit me or any doctor’s office, hospital, clinic, or other health care provider, information is collected about you and your physical and mental health. It may be information about your past, present, or future health or conditions, or the tests and treatment you got from me or from others, or about payment for health care. The information I collect from you is called “PHI,” which stands for “protected health information.” This information goes into your (or your child’s) medical or health care records in my office.
In this office, your/your child’s PHI is likely to include these kinds of information:
• Your/your child’s history
• Reasons you/your child came for treatment: Problems, complaints, symptoms, or needs
• Diagnoses: medical terms for your child’s problems or symptoms
• A treatment plan: a list of the treatments and other services that I think will best help you/your child
• Progress notes: Each time you come in, I write down some things about how you/your child are doing, what I notice, and what you tell me
• Records I get from others who treated you/your child or evaluated you/your child
• Psychological test scores, school records, and other reports
• Information about medications you/your child took or are taking
• Legal matters
• Billing and insurance information
• There may also be other kinds of information that go into your health care records
I use PHI for many purposes. For example, I may use it:
• To plan care and treatment
• To determine how well my treatments are working
• When I talk with other health care professionals who are also treating you/your child, such as your family doctor or the professional who referred you to me
• To show that you/your child actually received services from me, which I billed to you or to your health insurance company
• For teaching and training other health care professionals
• For medical or psychological research
• For public health officials trying to improve health care in this area of the country
• To improve the way I do my job by measuring the results of my work
Although your health care records in my office are my physical property, the information belongs to you. You can read your records, and if you want a copy I can make one for you (but I may charge you for the costs of copying and mailing, if you want it mailed to you). In some very rare situations, you cannot see all of what is in your records. If you find anything in your records that you think is incorrect or believe that something important is missing, you can ask me to amend your records, although in some rare situations I don’t have to agree to do that.
C. Privacy and the laws about privacy
I am required to tell you about privacy because of a federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA requires me to keep your PHI private and to give you this notice about my legal duties and my privacy practices. I will obey the rules described in this notice. If I change my privacy practices, they will apply to all PHI I keep, and I will provide you with a new notice of privacy practices.
D. How your protected health information can be used and shared
Except in some special circumstances, when I use your PHI in this office or disclose it to others, I share only the minimum necessary PHI needed for those other people to do their jobs. The law gives you rights to know about your PHI, to know how it is used, and to have a say in how it is shared.
Mainly, I will use and disclose your PHI for routine purposes to provide for your/your child’s care. For other uses, I must tell you about them and ask you to sign a written authorization form. However, the law also says that there are some uses and disclosures that don’t need your consent or authorization.
- 1. Uses and disclosures with your consent
After you have read this notice, you will be asked to sign a separate consent form to allow me to use and share your PHI. In almost all cases I intend to use your PHI here or share it with other people or organizations to provide treatment to you, arrange for payment for my services, or some other business functions called “health care operations.” In other words, I need information about you/your child and your/your child’s condition to provide care. You have to agree to let me collect the information, use it, and share it to care for you/your child properly. Therefore, you must sign the consent form before I begin to treat you/your child. If you do not agree and consent I cannot treat you/your child.
a. The basic uses and disclosure: For treatment, payment, and health care operations
For treatment. I use your medical information to provide you/your child with psychological treatments or services. These might include individual, family, or group therapy; psychological, educational, or vocational testing; treatment planning; or measuring the benefits of my services.
I may share your PHI with others who provide treatment to you/your child. I am likely to share your information with your/your child’s personal physician. If you/your child are being treated by a team, I can share some of your PHI with the team members, so that the services you receive will work best together. The other professionals treating you/your child will also enter their findings, the actions they took, and their plans into your medical record, and so I can decide what treatments work best and make up a treatment plan. I may refer you to other professionals or consultants for services I cannot provide. When I do this, I need to tell them things about you/your child and your/your child’s conditions. I will get back their findings and opinions, and those will go into your records here. If you receive treatment in the future from other professionals, I can also share your PHI with them. These are some examples so that you can see how I use and disclose your PHI for treatment.
For payment. I may use your information to bill you, your insurance, or others, so I can be paid for the treatments I provide. I may contact your insurance company to find out exactly what your insurance covers. I may have to tell them about your/your child’s diagnoses, treatments received, and the changes I expect in your/your child’s conditions. I will need to tell them about when we met, your/your child’s progress, and other similar things.
For health care operations. Using or disclosing your PHI for health care operations goes beyond my care and your payment. For example, I may use your PHI to see where I can make improvements in the care and services I provide. I may be required to supply some information to some government health agencies, so they can study disorders and treatment and make plans for services that are needed. If I do, your name and personal information will be removed from what I send.
b. Other uses and disclosures in health care
Appointment reminders. I may use and disclose your PHI to reschedule or remind you of appointments.
Treatment alternatives. I may use and disclose your PHI to tell you about or recommend possible treatments or alternatives that may be of help to you/your child.
Other benefits and services. I may use and disclose your PHI to tell you about health-related benefits or services that may be of interest to you.
Research. I may use or share your PHI to do research to improve treatments—for example, comparing two treatments for the same disorder, to see which works better or faster or costs less. In all cases, your name, address, and other personal information will be removed from the information given to researchers. If they need to know who you are, I will discuss the research project with you, and I will not send any information unless you sign a special authorization form.
- 2. Uses and disclosures that require your authorization
If I want to use your information for any purpose besides those described above, I need your permission on an authorization form. If you do allow me to use or disclose your PHI, you can cancel that permission in writing at any time. I would then stop using or disclosing your information for that purpose. Of course, I cannot take back any information I have already disclosed or used with your permission. - 3. Uses and disclosures that don’t require your consent or authorizationIn some cases, the law lets me use and disclose some of your PHI without your consent or authorization. Here are some examples of when I might do this.
a. When required by law
There are some federal, state, or local laws that require me to disclose PHI:
• I have to report suspected child abuse. If you are involved in a lawsuit or legal proceeding, and I receive a subpoena, discovery request, or other lawful process, I may have to release some of your PHI. I will only do so after trying to tell you about the request, consulting your lawyer, or trying to get a court order to protect the information they requested.
• I have to disclose some information to the government agencies that check on me to see that I am obeying the privacy laws.
b. For law enforcement purposes
I may release medical information if asked to do so by a law enforcement official to investigate a crime or criminal.
c. For public health activities
I may disclose some of your PHI to agencies that investigate diseases or injuries.
d. Relating to decedents
I may disclose PHI to coroners, medical examiners, or funeral directors, and to organizations relating to organ, eye, or tissue donations or transplants.
e. For specific government functions
I may disclose PHI of military personnel and veterans to government benefit programs relating to eligibility and enrollment. I may disclose your PHI to workers’ compensation and disability programs, to correctional facilities if you are an inmate, or to other government agencies for national security reasons.
f. To prevent a serious threat to health or safety
If I come to believe that there is a serious threat to your health or safety, or that of another person or the public, I can disclose some of your PHI.
- 4. Uses and disclosures where you have an opportunity to object
I can share some information about you with your family or close others. I will only share information with those involved in your care and anyone else you choose, such as close friends or clergy. I will ask you which persons you want me to tell, and what information you want me to tell them, about your condition or treatment. You can tell me what you want, and I will honor your wishes as long as it is not against the law.
If it is an emergency, and so I cannot ask if you disagree, I can share information if I believe that it is what you would have wanted and if I believe it will help you if I do share it. If I do share information, in an emergency, I will tell you as soon as I can. If you don’t approve I will stop, as long as it is not against the law.
- 5. An accounting of disclosures I have made
When I disclose your PHI, I may keep some records of whom I sent it to, when I sent it, and what I sent. You can get an accounting (a list) of many of these disclosures.
E. Your rights concerning your health information
- 1. You can ask me to communicate with you about your health and related issues in a particular way or at a certain place that is more private for you. For example, you can ask me to call you at home, and not at work, to schedule or cancel an appointment. I will try my best to do as you ask.
- 2. You have the right to ask me to limit what I tell people involved in your care or with payment for your care, such as family members and friends. I don’t have to agree to your request, but if I do agree, I will honor it except when it is against the law, or in an emergency, or when the information is necessary to treat you.
- 3. You have the right to look at the health information I have about you, such as your medical and billing records. You can get a copy of these records, but I may charge you. (See below.)
- 4. If you believe that the information in your records is incorrect or missing something important, you can ask me to make additions to your records to correct the situation. You have to make this request in writing. You must also tell me the reasons you want to make the changes.
- 5. You have the right to a copy of this notice. If I change this notice, I will give you a copy.
- 6. You have the right to file a complaint with me and with the Secretary of the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. All complaints must be in writing. Filing a complaint will not change the health care I provide to you in any way. You may have other rights that are granted to you by the laws of our state, and these may be the same as or different from the rights described above.
F. In the event of a breach
Because of recent changes in the laws (the HITECH Act) I have to tell you if I find out that some of your Protected Health Information has gotten to someone who should not have it. Only you and I and your other providers or your insurance company should have it. When someone else has gotten your information it is called a breach of privacy. For example, your records might have been sent to a wrong address or read by someone who should not have seen it at a hospital, or maybe your records were on a laptop computer that was lost. If those or any other kind of breach of privacy happens I will certainly tell you.
Sometimes the information that gets out in a privacy breach was encrypted – changed so no one can make sense of it but me. If the information is encrypted it is still safe and considered protected and would therefore not qualify as a breach.
If a breach happened I would have to figure out if there might be a way that the information that got out could harm you. Could someone use it to buy stuff with your stolen name? Could someone embarrass you by knowing about your private information? To figure that out I have to learn more about the information and what happened to it by doing a written Risk Assessment. If after I do that I decide that there is a really low chance that you would be harmed, I can decide that there was not a real “breach” and take no further action.
However, if I decide there has been a breach and you could be harmed by it is some way I have to tell you and also part of the government, the HHS. I will tell you about the breach within 60 days after I discover it. I will tell you about it in a written letter, which will include what kinds of information got out, what happened to it, and when this happened. I will tell you what you can do to protect yourself from any harm that might happen because of the breach. I will tell you about what I have done to investigate what happened, what I have done to lower any harm that might happen to you, and what I will do to see that it does not happen again.
G. Additional information/changes, questions, or problems
It is not possible for me to cover here all of the things that might come up involving your Protected Health Information. If I want to use or share your information in any way that is not coved by what is written here I will explain this new action to you and ask your written permission to use your information differently.
If you have a problem with how your PHI has been handled, or if you believe your privacy rights have been violated, contact me. As stated above, you have the right to file a complaint with me and with the Secretary of the U.S. Department of Health and Human Services. I promise that I will not in any way limit your care here or take any actions against you if you complain.
If you need more information or have questions about the privacy practices described above, please contact me at (203) 505-4564 or [email protected].
The effective date of this notice is September 23, 2013.
